Find the directory traversal in the nginx config using alias
This nginx location serves static assets via alias. There is a path-traversal flaw. Identify it and describe the fix.
Constraints:
- the
locationprefix has no trailing slash - the
aliastarget ends with a slash
location /assets {
alias /var/www/webapp/static/;
}Diagnose the cause.
Alias path traversal from the missing trailing slash on the location. Because /assets has no trailing slash, nginx appends the URI part after /assets to the alias as-is, so /assets../app/db.php resolves to /var/www/webapp/app/db.php — one level above static/. Fix: give both the location and the alias a trailing slash.
- ✗Treating the missing trailing slash as a style choice rather than a security flaw
- ✗Thinking nginx normalizes
..itself before matching against the alias - ✗Mistaking the directory traversal for information disclosure or DoS
- →Why does a trailing slash on
locationprevent the URI remainder from being appended? - →How does
aliasbehave differently fromrootwhen mapping the path?
The vulnerability
location /assets without a trailing slash is a prefix match. nginx takes the URI part after /assets and appends it to alias verbatim:
location /assets {
alias /var/www/webapp/static/;
}Request GET /assets../app/db.php → nginx appends ../app/db.php after static/ → /var/www/webapp/static/../app/db.php = /var/www/webapp/app/db.php. This is directory traversal one level up.
The fix
Give both the location and the alias a trailing slash:
location /assets/ {
alias /var/www/webapp/static/;
}✅ Now nginx matches exactly /assets/ and appends the remainder inside static/. ⚠️ A slash mismatch between location/alias is a classic misconfiguration.
